Whois vs GDPR, latest news

Anne P. Mitchell Esq. amitchell at isipp.com
Thu May 24 14:21:43 UTC 2018



> On May 23, 2018, at 7:18 PM, K. Scott Helms <kscott.helms at gmail.com> wrote:
> 
> Anything that can tie back to an individual data subject is PII, that means email addresses, names in combination with addresses or phone numbers, finger prints, or even insufficiently abstracted internal ID numbers/codes.

Don't forget IP addresses, as part of the wonderfully vague "online identifiers".

> Notice I didn't say EU citizen there, that's because the law and regulations (GDPR consists of both) intentionally cover any natural person in any of the 28 EU nations including the citizens of non-EU nations.
>  I don't go as far as I think Anne was suggesting, in that someone in EU airspace who sent an email or made a purchase is now suddenly an EU data subject. 

You may accuse me of being a lawyer here (and rightly so :-) ), but "in", as in "in the Union" (which is the actual language) is very much open to interpretation.  In a judicial system where lawsuits have turned on  - I kid you not - the interpretation of what a comma meant, I can almost guarantee you that "in the Union" is going to get interpreted through lawsuits, and it is absolutely not outside the realm of possibility that a U.S. citizen visiting in the EU will bring a lawsuit based on something happening with their PII while they were "in the Union".

> Any company that is covered by the GDPR must be extremely careful that any company they do business with is also compliant if that company will have access or act as a data processor.  That means that if you are a US company that has US only customers, but some of your customers have employees that are US citizens but who live in an EU nation then they are bound to only use providers that are GDPR compliant.  Now, this will result in contractual disputes and/or loss of business rather than having EU regulators fine your company directly.  The end result is that many many many companies that don't sell or market to the EU are finding themselves needing to comply in the same way that companies that sell services to medical companies often have to follow HIPAA  (and be audited) even though they provide medical services themselves.
> 

Actually, GDPR specifically requires processors to include statements of compliance right in their contracts;  we also strongly recommend that controllers insist on indemnification clauses in their contracts with processors, because if the processor screws up and there is a breach, the _controller_ can also be held liable, and the financial penalties in GDPR are very stiff.

Anne

Anne P. Mitchell, 
Attorney at Law
CEO/President, 
SuretyMail Email Reputation Certification and Inbox Delivery Assistance
GDPR Compliance Consultant
GDPR Compliance Certification
http://www.SuretyMail.com/
http://www.SuretyMail.eu/

Attorney at Law / Legislative Consultant
Author: Section 6 of the CAN-SPAM Act of 2003 (the Federal anti-spam law)
Author: The Email Deliverability Handbook
Legal Counsel: The CyberGreen Institute
Legal Counsel: The Earth Law Center
Member, California Bar Cyberspace Law Committee
Member, Colorado Cybersecurity Consortium
Member, Board of Directors, Asilomar Microcomputer Workshop
Member, Advisory Board, Cause for Awareness
Member, Elevations Credit Union Member Council
Former Chair, Asilomar Microcomputer Workshop
Ret. Professor of Law, Lincoln Law School of San Jose

Available for consultations by special arrangement.
amitchell at isipp.com | @AnnePMitchell
Facebook/AnnePMitchell  | LinkedIn/in/annemitchell








More information about the NANOG mailing list